users now login in with usernames not email addresses